> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens - URL: https://f4n6.co.uk/security-feed/active-exploitation-attempts-target-wso2-api-manager-jwt-bypass-with-forged-admin-tokens/ - Published: 2026-09-16T09:32:19.000Z - Updated: 2026-09-16T09:32:19.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-5430, Hacktron Team ## 1\. Executive summary A critical authentication bypass in WSO2 API Manager and related WSO2 gateway products — CVE-2026-5430, CVSS 10.0 (CRITICAL), CWE-347 (Improper Verification of Cryptographic Signature) — is under active exploitation in the wild, with watchTowr reporting forged JWT tokens carrying baked-in administrator privileges arriving at its honeypot network on 13 September 2026\. The flaw allows JWT authentication to be bypassed when a token is signed with an algorithm the service does not support but approves anyway, yielding unauthorized access, administrative account compromise and full account takeover. Affected products are WSO2 API Manager 4.1.0 through 4.6.0, API Control Plane 4.5.0/4.6.0, Traffic Manager 4.5.0/4.6.0 and Universal Gateway 4.5.0/4.6.0 — components that sit directly in the request path of internal APIs and hold consumer keys, secrets and backend credentials for every registered application. CVE-2026-5430 is **not** listed in CISA KEV and carries an EPSS score of 0%; the exploitation claim rests on a single vendor (watchTowr) and should be treated as credible but single-sourced. EMEA financial services entities running any affected WSO2 component in an internet-facing or DMZ role should treat this as a P1 patch-and-hunt event. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18 — classification of ICT-related incidents and cyber threats | Active in-the-wild exploitation (honeypot-observed forged admin JWTs, 13 Sep 2026) of an authentication bypass in a product that may sit in the entity's ICT estate, where successful exploitation yields administrative takeover of an API gateway holding credentials for every registered application | The entity must classify this as a cyber threat against its ICT estate and determine whether any exploitation against its own deployment meets incident classification thresholds; the credential-exposure blast radius (all registered applications' consumer keys and secrets, plus backend endpoint credentials) is the material driver of that classification | | DORA Art. 19 — reporting of major ICT-related incidents to competent authorities | Only engaged if exploitation succeeds against the entity's own WSO2 deployment and the resulting incident is classified as major under Art. 18 | Starts the reporting clock to the competent authority; the gateway's position in the request path means data-in-transit exposure and internal-service interaction must be scoped before the incident can be correctly described | NIS2 Art. 23 (incident reporting obligations) and UK NIS 2018 (OES/RDSP duties) impose parallel reporting duties on entities in those regimes where the same Art. 18/19 trigger is met. No other article in the regulatory reference is engaged by this item: the source provides no evidence of a third-party service-provider failure (DORA Art. 28–30), no concentration-risk finding (Art. 29), and no testing obligation specific to this flaw (Art. 24). ## 3\. Technical analysis & attack chain ### Confirmed attack chain 1. **Precondition.** The target runs an affected WSO2 component: API Manager 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 or 4.6.0; API Control Plane 4.5.0 or 4.6.0; Traffic Manager 4.5.0 or 4.6.0; or Universal Gateway 4.5.0 or 4.6.0. 2. **Craft.** The attacker constructs a JWT asserting administrator privileges and signs it using an algorithm the WSO2 service does not support. 3. **Bypass.** The service accepts the token despite the unsupported algorithm and approves it anyway — the signature is not properly verified (CWE-347). Per WSO2's May 2026 advisory: "JWT authentication can be bypassed when a token is signed using an unsupported algorithm, allowing unauthorized access." 4. **Access.** The forged token is accepted as authenticated, granting unauthorized access including potential compromise of administrative accounts and full account takeover. 5. **Observed in the wild.** watchTowr's honeypot network captured JWT tokens arriving on 13 September 2026 with baked-in administrator privileges, consistent with step 2–4 being executed against exposed instances. ### Vulnerability mechanism The defect is in the JWT validation path: the service accepts tokens signed with algorithms outside its supported set and approves them rather than rejecting them. This is a signature-verification failure, not a key-management or token-replay issue — the attacker does not need a valid signing key, only the ability to present a token whose `alg` header falls outside the service's supported set. The source does not name the specific unsupported algorithm(s) involved, and no proof-of-concept token is provided; do not assume a specific `alg` value when building detections. ### Post-exploitation — suspected, single-sourced watchTowr assesses that the forged token is *suspected* to be used to reach every API backend endpoint and its credentials, consumer keys and secrets for every registered application. Because the gateway by design intercepts API requests on their way to internal systems, watchTowr characterises the position as an opportunity to tap and steal sensitive data in transit and to interact with internal services — described as "lateral movement-as-a-service." **These are the vendor's impact assessments, not confirmed observations from the honeypot captures.** No exfiltration, persistence, C2 or lateral-movement artefacts have been published. Treat the post-exploitation narrative as a plausible consequence of the access level granted, not as an observed campaign. ### Attribution — unconfirmed The VERIFIED REFERENCE DATA lists "Hacktron Team" as an actor with **no MITRE ATT&CK profile**. The source, however, credits Hacktron Team with *discovering and reporting* the flaw — i.e. as the reporting research team, not as the exploiting party. No actor has been attributed to the honeypot-observed exploitation attempts. Any attribution of the exploitation activity is therefore unconfirmed and should not be used operationally. ### Version and severity discrepancies - **CVSS.** The VERIFIED REFERENCE DATA records CVSS 10.0 (CRITICAL). The Hacker News article's body text states 9.8, while the same article quotes watchTowr stating "CVSS 10.0". The authoritative value is **10.0**; the 9.8 figure in the article body is inconsistent with both the reference data and the vendor quote. - **Vendor advisory scope.** The BSI Germany advisory (WID-SEC-2026-2085) is a product-level WSO2 API Manager advisory describing multiple vulnerability classes — security-bypass, denial of service, privilege escalation, arbitrary code execution, SQL injection, cross-site scripting, information disclosure and data manipulation. That is broader than CVE-2026-5430, which is a single CWE-347 signature-verification flaw. The BSI advisory should not be read as describing this CVE's mechanism. - **EPSS.** EPSS is recorded at 0% despite vendor-reported in-the-wild exploitation. This is inconsistent with the exploitation claim and most likely reflects scoring lag or model limitations for a recently published CVE rather than an absence of exploitation activity. Do not use the 0% figure to deprioritise. ## 4\. Mitigation & containment ### P1 — within 24 hours 1. **Inventory.** Enumerate every instance of WSO2 API Manager 4.1.0–4.6.0, API Control Plane 4.5.0/4.6.0, Traffic Manager 4.5.0/4.6.0 and Universal Gateway 4.5.0/4.6.0\. Include non-production and partner-managed deployments — the gateway's credential store makes staging instances equally sensitive. 2. **Reduce exposure.** For any affected instance reachable from untrusted networks, restrict access at the network edge (WAF, reverse proxy or firewall) to known source ranges, and block external access to the gateway's authentication/token endpoints from untrusted networks until patched. 3. **Hunt for forged tokens.** Search gateway and upstream proxy logs for JWT authentication successes where the token's `alg` header is not one of the algorithms the deployment is configured to accept. Correlate any such success against legitimate identity-provider issuance events; a successful admin-privileged session with no corresponding IdP issuance is a high-confidence indicator of exploitation. 4. **Rotate on suspicion.** If any suspicious admin session is identified, rotate administrative credentials immediately, then rotate consumer keys and secrets for all registered applications and the backend endpoint credentials reachable through the gateway. Assume the gateway's credential store is compromised in that scenario. ### P2 — within 72 hours 1. **Patch.** Apply the vendor fixes. Community users: fixes are available via the WSO2 pull requests referenced in the vendor advisory (the source does not enumerate the PR URLs — obtain them from the WSO2 advisory). WSO2 Support Subscription holders: apply the update levels below. | Product | Version | Update level | | ---------------------- | ------- | ------------ | | WSO2 API Control Plane | 4.6.0 | 22 | | WSO2 API Control Plane | 4.5.0 | 58 | | WSO2 API Manager | 4.6.0 | 21 | | WSO2 API Manager | 4.5.0 | 57 | | WSO2 API Manager | 4.4.0 | 72 | | WSO2 API Manager | 4.3.0 | 108 | | WSO2 API Manager | 4.2.0 | 197 | | WSO2 API Manager | 4.1.0 | 257 | | WSO2 Traffic Manager | 4.6.0 | 21 | | WSO2 Traffic Manager | 4.5.0 | 56 | | WSO2 Universal Gateway | 4.6.0 | 21 | | WSO2 Universal Gateway | 4.5.0 | 57 | 1. **Enforce an algorithm allow-list.** Where patching cannot be completed inside 72 hours, enforce strict JWT algorithm allow-listing at the gateway or at an upstream proxy so that tokens whose `alg` header falls outside the supported set are rejected before reaching the WSO2 service. This is a compensating control, not a substitute for the vendor fix. ### P3 — within 7 days 1. **Scope lateral movement.** Review gateway ingress/egress for connections to internal services that do not correspond to legitimate registered-application traffic, and review whether sensitive data in transit through the gateway could have been captured. 2. **Third-party risk.** Where WSO2 is delivered, hosted or managed by a provider, engage that provider under the existing contract to confirm patch status and to obtain assurance on the update level applied. 3. **Detection coverage.** Add the behavioural detections in §5 to standing monitoring for the gateway tier. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source publishes no hashes, IP addresses, domains, URLs, filenames or command lines. The only observable artefacts described are authentication behaviours. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | JWT presented to a WSO2 gateway component signed with an algorithm outside the deployment's supported set, and accepted rather than rejected | WSO2 gateway authentication/audit logs; upstream reverse-proxy or WAF request logs | High — mechanism is stated by the vendor advisory | | JWT carrying administrator privileges arriving from a source that does not correspond to a legitimate identity-provider issuance event | Gateway authentication logs correlated against IdP issuance logs | Medium — derived from watchTowr honeypot captures, single-sourced | | Sessions accessing API backend endpoints and retrieving application consumer keys/secrets without a corresponding legitimate login | Gateway access logs; application credential-store audit logs | Low — watchTowr describes this as *suspected* post-exploitation use, not observed | ## 6\. Detection Insufficient indicators to author detection rules. **Hunting guidance (not a detection rule).** The source provides no file artefacts, command lines, mutexes, filenames, registry keys or network indicators, so no YARA or Sigma rule can be written without inventing content. The actionable hunt is log-side and product-specific: enumerate JWT authentication successes at the WSO2 gateway tier, decode the `alg` header of each token, and alert on any value outside the algorithms your deployment is configured to accept. Pair this with a correlation against identity-provider issuance events so that admin-privileged sessions with no matching issuance are surfaced. Because the source does not name the specific unsupported algorithm, the rule must be built as an allow-list of supported algorithms rather than a deny-list of a known-bad value. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ------------------------------------------------------------------------------ | ------------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-5430](https://nvd.nist.gov/vuln/detail/CVE-2026-5430?ref=f4n6.co.uk) | 10.0 Critical | — | 0% | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. Thi… | ## 7\. Sources - The Hacker News — *Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens* — https://thehackernews.com/2026/09/active-exploitation-attempts-target.html — 2026-09-16 - BSI Germany (CERT-Bund) — *\[NEU\] \[hoch\] WSO2 API Manager: Mehrere Schwachstellen* (WID-SEC-2026-2085) — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2085 — product-level advisory covering multiple WSO2 API Manager vulnerability classes; not specific to CVE-2026-5430 ## 8\. Adverse Trace position CVE-2026-5430 is a CVSS 10.0 (CRITICAL) authentication bypass, CWE-347, and is **not** in CISA KEV with an EPSS of 0%. We assess the exploitation claim as credible but **single-sourced** to watchTowr, whose honeypot captures of admin-privileged forged JWTs on 13 September 2026 are the sole evidence of in-the-wild activity; the post-exploitation impact narrative (credential harvesting across all registered applications, data-in-transit capture, internal-service interaction) is the vendor's assessment and is explicitly hedged as suspected. The EPSS 0% reading is inconsistent with the exploitation claim and should not be used to deprioritise. Attribution is unconfirmed: the VERIFIED REFERENCE DATA lists "Hacktron Team" with no MITRE ATT&CK profile, and the source in any case describes that team as the finder and reporter of the flaw rather than the exploiting party — no actor has been attributed to the honeypot activity. Client impact is high for any EMEA financial services entity running an affected WSO2 component in an internet-facing or DMZ role, because the gateway brokers credentials for every registered application and sits in the request path to internal systems; the blast radius of a successful bypass is credential compromise across the API estate, not a single application. We will monitor for a second independent source confirming in-the-wild exploitation, for publication of the WSO2 pull-request references for community users, for any CISA KEV addition, and for any actor attribution; we will reissue this advisory if any of those change the assessment. --- [Read the original source →](https://thehackernews.com/2026/09/active-exploitation-attempts-target.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*